{"id":108047,"date":"2023-04-23T12:48:18","date_gmt":"2023-04-23T10:48:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=108047"},"modified":"2023-04-24T10:41:12","modified_gmt":"2023-04-24T08:41:12","slug":"v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","title":{"rendered":"V PyPI bola realizovan\u00e1 mo\u017enos\u0165 publikova\u0165 bal\u00edky bez viazanosti na hesl\u00e1 a API tokeny","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V repozit\u00e1ri Python bal\u00edkov PyPI (Python Package Index) bola zaveden\u00e1 nov\u00e1 zabezpe\u010den\u00e1 met\u00f3da publikovania bal\u00edkov, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 uchov\u00e1vanie pevn\u00fdch hesiel a pr\u00edstupov\u00fdch tokenov na extern\u00fdch syst\u00e9moch (napr\u00edklad na GitHub Actions). Nov\u00e1 met\u00f3da autentifik\u00e1cie sa naz\u00fdva 'Trusted Publishers' a m\u00e1 za cie\u013e vyrie\u0161i\u0165 probl\u00e9m s publikovan\u00edm \u0161kodliv\u00fdch aktualiz\u00e1ci\u00ed sp\u00f4soben\u00fdch kompromit\u00e1ciou extern\u00fdch syst\u00e9mov a dostan\u00edm preddefinovan\u00fdch hesiel alebo tokenov do r\u00fak zlodejov. <\/p>\n

Nov\u00e1 met\u00f3da autentifik\u00e1cie je zalo\u017een\u00e1 na \u0161tandarde OpenID Connect (OIDC), ktor\u00fd predpoklad\u00e1 vyu\u017e\u00edvanie autentifika\u010dn\u00fdch tokenov s obmedzen\u00fdm \u010dasom platnosti, ktor\u00e9 si navz\u00e1jom vymie\u0148aj\u00fa extern\u00e9 slu\u017eby a katal\u00f3g PyPI na potvrdenie publik\u00e1cie bal\u00edka, namiesto tradi\u010dn\u00e9ho prihlasovania\/zadan\u00e9ho hesla alebo ru\u010dne generovan\u00fdch trval\u00fdch pr\u00edstupov\u00fdch tokenov k API. Mo\u017enos\u0165 aplik\u00e1cie mechanizmu 'Trusted Publishers' bola u\u017e implementovan\u00e1 pre spracovate\u013eov sp\u00fa\u0161\u0165an\u00fdch v GitHub Actions. V bud\u00facnosti sa o\u010dak\u00e1va implement\u00e1cia podpory Trusted Publishers aj pre \u010fal\u0161ie extern\u00e9 slu\u017eby. <\/p>\n

Sprievodn\u00e9 bal\u00edky m\u00f4\u017eu na strane PyPI nastavi\u0165 znak d\u00f4very identifik\u00e1torom poskytovan\u00fdm extern\u00fdmi poskytovate\u013emi OpenID (IdP, OpenID Connect Identity Provider), ktor\u00e9 extern\u00e1 slu\u017eba pou\u017eije na po\u017eiadanie o kr\u00e1tkodob\u00e9 tokeny od PyPI. Generovan\u00e9 tokeny OpenID Connect potvrdzuj\u00fa spojenie medzi projektom a spracovate\u013eom, \u010do umo\u017e\u0148uje PyPI vykon\u00e1va\u0165 dodato\u010dn\u00fa verifik\u00e1ciu metad\u00e1t, napr\u00edklad overova\u0165, \u017ee publikovan\u00fd bal\u00edk je v s\u00falade s ur\u010dit\u00fdm repozit\u00e1rom. Tokeny sa neuchov\u00e1vaj\u00fa, s\u00fa viazan\u00e9 na konkr\u00e9tne API a automaticky prest\u00e1vaj\u00fa plati\u0165 po uplynut\u00ed kr\u00e1tkeho \u010dasov\u00e9ho obdobia. <\/p>\n

Navy\u0161e sa d\u00e1 spomen\u00fa\u0165 spr\u00e1va spolo\u010dnosti Sonatype s inform\u00e1ciami o odhalen\u00ed 6933 \u0161kodliv\u00fdch bal\u00edkov v katal\u00f3gu PyPI v marci 2023. Od roku 2019 prekro\u010dil po\u010det odhalen\u00fdch \u0161kodliv\u00fdch bal\u00edkov v PyPI 115 tis\u00edc. V\u00e4\u010d\u0161ina \u0161kodliv\u00fdch bal\u00edkov sa maskuje ako popul\u00e1rne kni\u017enice pomocou typov\u00e9ho podv\u00e1dzania (prira\u010fovanie podobn\u00fdch mien, ktor\u00e9 sa l\u00ed\u0161ia jednotliv\u00fdmi znakmi, napr\u00edklad exampl namiesto example, djangoo namiesto django, pyhton namiesto python at\u010f.) - zlodeji sa spoliehaj\u00fa na nepozorn\u00fdch pou\u017e\u00edvate\u013eov, ktor\u00ed urobili preklep alebo si nev\u0161imli rozdiely v n\u00e1zve pri vyh\u013ead\u00e1van\u00ed. \u0160kodliv\u00e9 \u010dinnosti sa zvy\u010dajne zni\u017euj\u00fa na odosielanie d\u00f4vern\u00fdch \u00fadajov n\u00e1jden\u00fdch na lok\u00e1lnom syst\u00e9me v d\u00f4sledku preuk\u00e1zania typov\u00fdch s\u00faborov s heslami, pr\u00edstupov\u00fdmi k\u013e\u00fa\u010dmi, kryptomenov\u00fdmi pe\u0148a\u017eenkami, tokenmi, rel\u00e1ciov\u00fdmi Cookies a in\u00fdmi d\u00f4vern\u00fdmi inform\u00e1ciami.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 GitHub Actions) \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ‘Trusted Publishers’ \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108047","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V PyPI je mo\u017en\u00e9 publikovanie bal\u00edkov bez v\u00e4zby na hesl\u00e1 a API tokeny | ProHoster","description":"V repozit\u00e1ri Python bal\u00edkov PyPI (Python Package Index) je dostupn\u00e1 nov\u00e1 zabezpe\u010den\u00e1 met\u00f3da publikovania bal\u00edkov, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 ukladanie na extern\u00fdch syst\u00e9moch (napr\u00edklad v.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u0430\u0440\u043e\u043b\u044f\u043c \u0438 \u0442\u043e\u043a\u0435\u043d\u0430\u043c API | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-23T10:48:18+00:00","article:modified_time":"2023-04-24T08:41:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=108047"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108047\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=108047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=108047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=108047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}